Set limits on disk usage
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Set limits on disk usage
There are several methods for controlling disk space used by Splunk. Most disk space will be used by Splunk's indexes, which include the compressed raw data. If you run out of disk space, Splunk will stop indexing. You can set a minimum free space limit to control how low you will let free disk space fall before indexing stops. Indexing will resume once space exceeds the minimum.
Set minimum free disk space
You can set a minimum amount of space to keep free on the disk where indexed data is stored. If the limit is reached, splunkd stops operating. Both indexing and searching are affected:
- Periodically,
splunkdwill check space on all partitions that contain splunk indexes. If the free disk space limit has been reached on any of those partitions,splunkdstops indexing data until more space is available. A UI banner andsplunkdwarning are posted to indicate the need to clear more disk space. - Before attempting to launch a search, Splunk will require this amount of free space on the filesystem where the dispatch directory is stored,
$SPLUNK_HOME/var/run/splunk/dispatch
The default minimum free disk space is 2000MB.
Note:
- Splunk will not clear any of its own disk space with this method. It will simply pause for more space to become available.
- Events can be lost if they are not written to a file during such a pause.
You can set minimium free disk space through Splunk Web, the CLI, or the server.conf configuration file.
In Splunk Web
- Click Manager in the upper right corner of Splunk Web.
- Click System settings.
- Click General settings.
- Under the Index settings section, find Pause indexing if free disk space (in MB) falls below::
- Enter your desired minimum free disk space in megabytes.
- Click Save.
Restart Splunk for your changes to take effect.
From the command line interface (CLI)
You can set the minimum free disk space via Splunk's CLI. To use the CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. Here, you set the minimum free disk space to 20,000MB (20GB):
# splunk set minfreemb 20000
# splunk restart
In server.conf
You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:
[diskUsage] minFreeSpace = <num>
Note that <num> represents megabytes. The default is 2000.
Control database storage
The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.
For detailed instructions on how to use indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".
For information on creating archive scripts, see "Archive indexed data".
For detailed information on index storage, see "How Splunk stores indexes".
This documentation applies to the following versions of Splunk: 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.
Comments
To set minimum free disk space
In splunk web
Click Manager -> Click System settings -> Click General Setting.
Inside that
Under the Index settings section, find Pause indexing if free disk space (in MB) falls below::
Enter your value and SAVE.
Ranjyotiprakash - Thanks for pointing out that problem with the procedure. It has now been fixed.